At this time (first public beta, 2011-08-17) all communication is over HTTP. We will introduce HTTPS later on, where necessary.

For cloud binding, no passwords are used. Monochrome uses a single-use passphrase mechanism to set up the binding. The passphrase is sent to your email account, so as long as your email account is secure there is no additional security exposure.